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By JacoL C. Ifoser and Bugald 0. Black 


SUMMARY 

The Initiating system described In this report vas designed to meet 
the requirements of such a system as detennlned by a study of data ob- 
tained from full-scale esperlmental and accidental airplane crashes. An 
exan^le of the application of these requirements In the design of an 
Initiating system for a twin-engined piston-powered airplane Is given. 

The proposed system can be designed so that It acts rapidly ftnfl so 
that accidental operation Is improbable. In addition. If the system 
should operate accidentally, catastrophic results are also Improbable. 

This system Is selective In that It Inerts only those damaged zones where 
combustibles are splU^* system can be used on all airplanes whether 

they are powered by reciprocating, turboprop, or turbojet engines. 


INTROriUCTION 

Research has shown (ref. l) that many airplane cra^ fires can be 
prevented by a crash-fire prevention system. Such a system Includes an 
Initiating system, which detects that conditions for crash fire exist and . 
turns on an Inerting system, which suppresses the ignition sources that 
can Ignite spilled combustibles. Suppression of the Ignition sources Is 
accomplished by cooling the hot metal of the engine exhaust system, dis- 
charging a fire-extlngulshlng agent Into the engine induction system, 
shutting off the flow of fuel and oil to the engines, and deenergizing 
the electrical system of the airplane. The Inerting system is described 
in detail in references 1 and 2. This report discusses a proposed Ini- 
tiating system for crash-f ire-prevention systems. 

An Initiating system may be designed so that the pilot must Initiate 
its action or such that it is completely automatic with a manual override. 
Qbe system also may be designed to react only to crash damage that can lead 
to fire or to react to any impact. Finally, the system may be designed to 
select and inert only the zone adjacent to the damage In which fire may 
occur or to inert all zones carrying potentieQ. ignition sources however re- 
mote from the damage. 
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From the study of a variety of approaches to the design of Initiat- 
ing systems^ the form proposed In this report Is considered to meet the 
requirements of rapid and reliable actuation while largely avoiding the 
hazards associated with accidental functioning. Xhese hazards stem from 
the fact that one step In the inerting procedure for nacelle Ignition 
sources Involves shutting off fuel flow to the engine. Therefore, the 
proposed Initiating system activates only that part of the flre-preventlon 
system that Inerts Ignition sources local to cradi danage where fire Is 
lUcely. The remainder of the airplane can function In the normal way. 

An alternate approach to the design of Initiating systems would he 
to cause all elements of the flre-preventlon system on the airplane to 
function simultaneously In the event of crash damage anywhere on the air- 
plane. However, In view of the fact that power Is lost from all engines 
In such a system, accidental operation of the flre-preventlon system raises 
the danger of a serloiis accident. For this reason detailed study of In- 
itiating systems of this type was not made. 

Because the proposed system actuates the inerting system only In 
those zones where fire may occur, it allows the airplane to fly with the 
benefit of fire pirotection after striking an obstacle on takeoff or land- 
ing. In addition, after the airplane makes a belly landing and there 
is no need for further flight, then the entire inerting system could be 
actuated either automatically or manually. 

Several reqiairements must be met in the design of an initiating sys- 
tem. These requirements axe dictated by the speed with which a fire can 
occur after a crash, the sequence of events that lead to a fire, and the 
fact that the fire-prevention system must not hinder either the normal or 
emergency operation of the airplane. These requirements will be similar 
for all airplanes whether they axe powered by reciprocating, turboprop, 
or turbojet engines. 


HBQ.UIEBMEI9TS 

An Initiating system for a cra^-fixe-preventlon system must be able 
to de;tect the presence of airplane damage that may lead to fire. It must 
then actuate that portion of the prevention system that suppresses the 
potential hazard in time to prevent the fire. 

The requirements of this Initiating system axe discussed In the fol- 
lowing paragraphs. 
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Detecting Damage Leading to Combustible Spillage 

The Initiating system should detect only crash damage that creates 
combustible pillage since a crash fire cannot occur If a combustible is 
not filled. Combustible spillage may occur when an engine breaks out of 
its mounts and ruptures fuel and oil lines, when the propeller-reduction- 
gear housing of the engine Is broken as the propeller strikes obstacles, 
and when the fuel tanks are penetrated, for example, by trees, buildings, 
or the airplane landing gear. The Initiating system should not, there- 
fore, detect crash damage that will not lead to combustible spillage. 

For example, minor collisions that may damage a wing tip, dent a wing 
leading edge, or wrinkle the belly skin should mt be sensed. 


Inerting Selected Parts of Airplane 

The initiating system should trip the inerting system only in those 
airplane zones where combustibles have been spilled. This selective 
inerting of damaged zones allows the airplane to fly with the benefit of 
fire protection after striking an obstacle. For example, if an airplane 
strikes an obstacle that penetrates the fuel tanks in one wing, that part 
of the electrical system in the wing not needed for emergency airplane 
operation should be shut off at once to prevent arcs, sparks, and hot 
wires from starting a fire. However, the engine adjacent to the damaged 
fuel tanks need not be stopped at this time. Fuel from the ruptured wing 
will not spread apanwise outside the wing during flight, and there is 
little chance that the fuel will reach an ignition source in the nacelle 
If the wing is properly bulkheaded. 

In some airplanes, however, fuel may travel throu^ hot-air ducts or 
passeigeways in the wing to ignition sources in the engine nacelle or 
fuselage ( combustion heaters or heat exchangers) . Shutoff systems must 
be installed in these hot-air ducts or passageways to prevent this flow, 
or the ignition sources must be suppressed. 

If, on the other hand, an engine is so damaged that combustibles are 
filled in the nacelle, this engine should be shut down and the ignition 
sources in this nacelle suppi*essed. Other engines need not be shut down, 
but can provide power for continued fll^t. 


Actuation of Entire Fire-Prevention System When Airplane 

Is Ho Longer Flying 

If, subsequent to an accident, the airplane makes a Tdieels-up cradb 
landing and there is no further need for engine power, the entire fire- 
prevention system should act. This step is necessary because fuel spi ll i n g 
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from ruptured vlug tanks can spray forward and ^read spanwlse as tke 
airplane slows down and may reach Ignition sources In an png ina nacelle. 


Deenergizing of Electric Power Circuits of Eire -Prevention 

System After Actuation 

The flre-preventlon system should not In Itself become an Ignition 
source. It Is desirable a^er flre-preventlon measures have been started 
to remove electric power from all fire -prevention- system circuits that 
have been actuated^ since these electric wires may also be damaged or 
broken In the crash and thus become Ignition sources. 


Immediate and Automatic Action 

A requirement equally as Important as those already described Is 
that the Initiating system should act Immediately and automatically 
because fire can occur quickly under certain circumstances. Immediate 
actuation la necessary because of the proximity of combustibles to the 
many ignition sources in the engine nacelle of all present-day airplanes, 
regardless of the type of powerplant used. These ignition sources must 
be suppressed before they have been reached by fuel, oil, l^rdraulic 
fluid, or alcohol spilling from broken tubing or storage tanks if fire 
is to be prevented. 

Automatic actuation Is necessary because many of the Ignition sources 
in the engine nacelles and wings can start a crash fire faster than the 
crew can sense that combustibles have been spilled and trip the Inerting 
system. The inclusion of human reaction time would allow some ignition 
sources time to start a fire. 

The need for r£q»id automatic action of the fire-prevention system 
has been shown by the eacperlmental crashes. In these crashes, some fires 
started within 0.1 second after Impact (ref. 2) . For example, fires 
occurred when the engine induction system was tom open exposing the en- 
closed fuel-air mlxtirre to the ignition sources in the nacelle. During 
the course of this crash-fire study, the induction system was tom open 
in 6 of the 42 engines involved. The frequency with which the induction 
systems were damaged indicated that this potential source of crash fires 
cannot be Ignored. 

Breaking the propeller-reduction-gear housing away from the power 
section is another crash event that can result in fire almost Immediately. 
In a plston-engine-airplane crash, for example, the lubricating oil from 
a damsiged prqpeller-reduction-gear housing can be carried by the airstream 
over the outside of the engine to the exhaust system. In the eacperimental 
crashes, the reduction-gear housings on the piston engines were ruptured 
in 8 of the 42 engines involved. 
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Similar circumstances can occur in turboprop nacelles. For example, 
all four propeller-reduction-gear housings were broken during a crash 
of a turboprop airplane at London, England. In another crash of a -similar 
airplane at Chicago, Illinois, the propeller-reduct ion- gear housings were 
broken in two of the four engines. Tearing open the reduct ion- gear hous- 
ing spills oil into the engine inlet of some turbopropeller engines where 
it can be carried into the engine to start a fire. 

The initiating system must also act rapidly when an obstacle pene- 
trates the wing, breaking the electric wiring and tearing open the fuel 
tanks. When fuel tanks are tom open, fuel is released in the immediate 
vicinity of electric arcs or sparks that are formed when the electric 
wiring is broken or grounded. Conseq.uently, fire can occur very quickly. 

The incandescent filaments of landing lights that are normally present 
during a landing or takeoff at ni^t can also ignite filled fuel if the 
surrounding bulb is broken. Ignition of fuel spilled in the wing by the 
Incandescent filaments of a landing ll^t was observed in an experimental 
crash (ref. 2) . 


Prevention of Accidental Operation 

The fire-prevention system diould not be actuated accidentally by a 
malfunctioning switch or short circuit in the initiating i^stem. Acci- 
dental operation could easily cause a crash by stopping the engine of an 
airplane at a critical time during takeoff or landing. The initiating 
system can be so designed that a short circuit developing in a switch or 
in the electric wiring would not actuate the ertire inerting system or 
any part of it. 

The Air Transport Association of America as well as others is con- 
cerned about the hazaz^ that can result from the accidental operation of 
any crash-fire-prevention system that can shut down all engines at the 
same time. The proposed initiating system was planned to take this haz- 
ard into account. 


Manual Control and Monitoring 

Provisions should be made for manual actuation of the fire-prevention 
system. The system should be so arranged that it can be actuated manually, 
because not all situations that lead to fire can be detected automatically 
without making the Initiating system imduly sensitive and, hence, subject 
to potential accidental operation. For example, if a fuel tank is tom 
open in flight, the initiating system trips only the inerting system in 
this fuel-tank zone. All engines would continue to run. Subsequently, 
when the pilot makes a normal landing, the Initiating system will not 
trip the rest of the inerting system since no other damage has occurred. 
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Fuel escaping from the ruptured fuel tank can move forward and spanwise 
as the airplane slows down, however, and reach Ignition sources In an 
operating engine nacelle. Because the fuel will not reach these Ignition 
sources for a few seconds after touchdown, the crew can trip the entire 
fire-prevention system after a safe landing is assured. Also, while the 
airplane is In normal, fllgpit, there may he times when the crew would 
want to turn off electric power to the crash-fire-prevention system. 

This action reduces the possibility of accidental operation during normal 
flight. 

Means for monitoring the system axe desired to inform the crew when 
switches have closed or portions of the system are mEO.f\mctionlng. An 
indication on the monitoring system that a switch has closed tells the 
crew that dangerous damage has occuirred or that a switch is malfunction- 
ing. A crew check can then determine whether a malfunction is involved. 
If malfunctioning is involved, this portion of the system can be iso- 
lated while protection is still provided by the remainder of the system. 
The monitoring system should also he ahle to detect an imminent short 
circuit so that this i>axt of the system can be Isolated. Methods for 
providing this degree of monitoring and control have been devised with- 
out undue complexity. 


EXAMPLE OF APPLICATION TO A TWIN-ENGINED AIRPLANE 

In this exan^le, it is assumed that the airplane is powered by two 
reciprocating engines, the fuel, is stored in the wings, pant of the wing 
fuel tanks are located above or near the main landing gear, and the land- 
ing gear, when broken in a crash, can rupture these fuel tanks. 

The proposed initiating system is shown diagrammatically in figure 
1. This block diagram shows how the various initiating switches are in- 
corporated into the fire -prevention ^stem anfl indicates the electric 
interconnections necessary to satisfy the requirements for the initiating 
system. The m o n itorring, manual control, and inerting power cut-off cir- 
cuits have been deleted to sinplify the diagram. 

In order to satisfy the requirement that the initiating system detect 
crash damage that will cause combustible spillage, switches would be lo- 
cated as follows: a switch in each nacelle to detect engine breakout, 

a switch to detect when the propeller-reduction-gear housing is broken out 
of the nose section of each engine, a switch to detect when each main land- 
ing gear is tom out, and a switch in frront of each fuel-tank zone to 
detect when a fuel tank ml^t be damaged. 

The engine-breakout switch indicates when the crash impact has moved 
the engine enough that the fuel and oil plumbing lines are liable to be 
broken. Because there is usually some slack in the flexible fuel a.nfl oil 
lines, the engines will have considerable movement before these lines are 
broken. The designer thus has considerable freedom in selecting the value 
of the engine movement that will actuate such a switch. 
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The ©witch should not operate during either normal or rou^ engine 
operation. Further, it ^ould not operate upon minor intact of the pro- 
peller blades with the ground. It should operate, however, before suffi- 
cient engine movement has occurred to break the fuel and oil lines. 

A switch similar in principle to the engine-breakout switch proposed 
above was installed between the mounting ring and the engine for an ex- 
perimental crash as shown in figure 2. This switch actuated with a for- 
ward or aft engine movement of 0.17 inch. The switch consisted of a 
microswitch operated by a notched ^ring- loaded shaft. The entire assCTi- 
bly was mounted in a box. The engine movement was detected by installing 
the switch body on the engine mounting ring with the spring-loaded shaft 
bearing on a plate which was fastened to the engine. Excessive jforeward 
or aft engine movoaent would move the shaft far enough away from its 
center position that the slant sides of the notch would move the lever of 
the microswitch and close it. 

In tests with this switch, fore and aft engine movements to 0.03 
inch were recorded during normal engine operation. With rough engine 
operation, the fore and aft engine movement was no more than that during 
nonmal engine operation. During rou^ engine operation, the engine move- 
ment Increased in a rotary direction Instead of fore and aft. During 
these crash tests, fore and aft engine movements from 0.25 to 0.29 inch 
were measured when the propeller blades struck an abutment of railroad 
ties anri dirt. This propeller inpact was fairly severe and produced in- 
cipient failure of the engine mounts but did not break oil and fuel l in es. 

It appears, then, that a switch setting of 0.25 inch would be adequate 
for this specific engine installation. 

The propeller-reduction-gear switch, shown on the block diagram 
(fig. l), indicates when the propeller-reduction-gear housing of the en- 
gine breaks away from the power section. A switch similar to that used 
to detect engine movement could be used for this purpose. A proposed 
method of installing such a switch on the reduction-gear housing is shown 
In figure 3. The switch body would be fastened to the flange on the power 
section of the engine with the spring-loaded shaft resting on the reduction- 
gear housing. This location was chosen because, in the experimental 
crashes, the reduction-gear housings always broke away from the power 
section at this fleinge. 

The landing-gear switch (fig. l) indicates when the landing gear is 
torn out and fuel may spill into the wheel well. One method of installing 
such a switch is shown in figure 4. This switch assembly consists of a 
cable attached to the landing gear in such a way that it actuates the 
switch when the landing gear is tom off. 

The fuel-tank-penetration switch (fig. l) indicates whm the wing 
has been penetrated, thus indicating that a fuel tank may be tom open 
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spllUng fuel and TareaJciug electric wiring. This switch is essentially 
the some as the engine -breakout switch exc^t that a cable is attached to 
the notched spring-loaded shaft as shown in figure 5. The con^lete switch 
was Installed inside the wing. The cable was supported at intervals along 
the spar in front of the fuel tanks as diown in figure 6 . Cradi tests of 
this switch showed that this cable ^ould be located far enou^ ahead of 
the front spar to allow the cable to close the switch before the obstacle 
has reached the ^ar. However, the cable diould be fstr enough behind the 
leading edge of the wing so that minor inlets such as a bird striking 
the wing will not close the switch. The switch should also be located 
close to the bottom of the wing to detect a penetration that could be 
produced by a slanted obstacle or one that does not pierce the entire . 
leading edge of the wing. It is very important that the wing fuel- 
tank-penetratlon switch be cable operated so that electric wiring for 
the switch need not be carried in front of the fuel tanks. Eliminating 
the wiring prevents the eparks or arcs that would occur if this wiring 
were broken. 

The electric wiring normally carried in the wing in front of the 
fuel tanka may also be an ignition source when it is broken. Even after 
the inerting eystem has disconnected the wiring from power sources 
grounded the circuits, an Interval of about 0.1 second is needed to de- 
energize these electric circuits (ref. l) . The distance between the 
leading edge of the wing and the fuel tanks in most airplanes is too 
small to allow this much time, even if electric circuits were deener- 
gized at the moment the leading edge Ertrikes an obstacle. Therefore, it 
is recommended that, whenever possible, this eleptrlc wiring be moved 
to the rear of the wing behind and near the top of the rear ^ar. It is 
also suggested that this wiring be sheathed. The ^eathlng can consist 
in placing the electric wiring in loose, elastic, heat-resisting sleeves 
that would remain Intact under tension until the wiring inside breaks. 

In this way, any arc resulting from a break in the electric wiring will 
be shielded from combustibles imtll 'Uie arcing has subsided. 

These four switches, then, detect the variovis ways in which damage 
can occur and result in combustible spillage, if an airplane of the type 
assumed craves. 

In order to obtain selective inerting, the second requirement, the 
initiating switches are electrically connected to the fire-prevention 
system in such a way that only the inerting system local to the airplane 
damsige is actuated. In figure 1, the line from the engine-breakout and 
reduction-gear-houslng switches indicates that the switches actuate the 
inerting system for that nacelle in which these switches have been in- 
stalled and send a signal to the arming control box. Likewise, if the 
l a n d in g gear is damaged, the landing-gear switch inerts the nacelle into 
which the landing geeir retracts and also sends a signal to the arming 
control box. The landing-gear switch is provided only in those airplanes 
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vhere landing-gear damage is likely to produce (Knnbustlble epUlage. Tbie 
fuel-tank-penetration switch, deezisrglzes/ in the daimiged. wing, those 
electric circuits not needed for emergency operation of the airpleine. 

This selective inerting protects the zones adjacent to the cra^ damage. 

The next requirement is to actuate the entire inerting system after 
the pilot has flown the airplane to a la-nding area^ a wheels-iga crasdi 
landing has been madej; and. engine power is no longer needed. This ground 
contact can be sensed by contact pressure switches, which are commercially 
available. The switches are in strip. form and can be fastened to the 
underside of the airplane at any location. A contact pressure of 150 
pounds per square inch any place on the strip closes the electric 
circuit . 

A signal in the arming control box from one of the four initiating 
switches previously described can be combined with signals from two ground- 
contact switches (fig. l) . These combined signals, when recleved in the 
total- inerting control box (fig. l), activate the entire fire-prevention 
system which then suppresses all remaining ignition sources on the air- 
plane. For example, if an engine-breakout switch, pTOpeller-reduction- 
gear switch, 3anding-gear swit<di, or a wing fuel-tank-penetration switch, 
and any two ground-contact switches have been closed, the entire inerting 
system will act . 

The requirement for simultaneous signals from two ground-contact 
switches in conjunction with a signal from one other initiating switch 
prevents the entire inerting system from functioning while the airplane 
is still in the air. "Bird strikes," minor collisions with trees, flying 
debris from the runway, and so foirth, may close a single ground-contact 
switch, but it is extremely unlikely that two switches would be closed 
simultaneously if these switches are located properly. 

The proper positions of the contact pressure switches on an airplane 
and the number needed d^end upon the airplane configuration. On any 
airplane, however, the switches must be located in such a way that two of 
the switches will close when the airplane is on the ground. This must 
occur when any one or any combination of landing gear is retracted or 
torn off. In addition, these switches should be placed so that impact 
with a pole or tree will not close two switches at the same time. Placing 
the switches near each other, either laterally or longitudinally, would 
allow a single pole to close both switches before the airplane landed. 

The contact pressure switches should also be installed with the 
electric leads entering the fuselage behind the switch instead of in 
front of it. Installed in this way, there will be time for the switch to 
close and send a signal before the switch is tom conpletely away from the 
airplane. 
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How these conditions would fix the position and number of ground con- 
tact switches Is shown hy the airplane chosen as an example. Xhe switch 
positions chosen are shown schematically In figure 7. lEhe two contact 
pressure switches A on the underside of each nacelle would close If the 
airplane landed with the entire landing gear retracted or tom off. To 
satisfy the condition of two ground-contact switches helng closed when one 
main landing gear Is retracted or tom off, a nacelle switch and a switch 
on one side of the helly at the rear B form the pair. In a similar way. 

If one main landing gear and the nose gear have heen tom out, a nacelle 
switch and a switch on the fuselage nose C maVe up the pair. 


CO]!ICLUDIiaG EEMABKS 

The Initiating system pr closed In this report meets the requirements 
for rapid and reliable actuation of the Inerting system while largely 
avoiding the hazards associated with accldentEJ. functioning. The Initi- 
ating system discussed In this report Is based upon the use of mechanically 
simple switches that detect linear movement or contact pressure and avoids 
the use of Inenrtla and frangible switches. Switches of these types were 
tested In experimental crashes. Experience showed that In order for In- 
ertia switches to operate rapidly enou^ to trip the Inerting system with- 
in the allowable time, the sensitivity to acceleration must be hlgpi. With 
hl£^ sensitivity, the switches may be operated accidentally by minor ac- 
celerations. Also, the experimental crashes showed that frangible switches 
may not function even thou^ the structure adjacent to the switch was 
heavily damaged. 

The proposed system can be modified from the arrangement shown in 
this report to meet the special needs of various airplane configurations. 
The method used to detect dangerous damage in each of the airplane com- 
ponents described here can be enployed for the corresponding components 
in any airplane. However, the number of damage detector elements and their 
position on the airplane can vary according to the airplane design. 

In order to provide an extra margin of safety in airplanes carrying 
crash-fire protection, it would be desirable to have means for restoring 
the fuel and oil flow to the engines after the crash-fire system has func- 
tioned. In this way, the crew can restart any engine, if in their opinion 
the degree of engine damage and the nature of the emergency warrant a 
restart . 


Lewis Fll^t Propulsion Laboratory 

Hational Advisory Committee for Aeronautics 
Cleveland, Ohio, July 2, 1956 
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Figure 1. - •RTneir diagram allowing how initiating switches are Incorporated into crash-f ire- 
prevention system for twin-engined airplane. 
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Figure 7. 
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- Location of fuselage-belly-contact switches on twin-engined airplane 
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